Ccnp

What is Network Address Translation?

The Network Address Translation (NAT) functionality in the Cisco routers allows privately addressed networks to connect to public networks such as the Internet. When the privately addressed network (the “inside”) sends a packet through the NAT router, the addresses are converted to legal (registered) IP addresses before being passed to the “outside”.

Many sites have been using pass-through firewall gateways to provide this functionality. Well, it’s now available in your Cisco router!

First of all, I want to quickly answer the question of what is DHCP. DHCP is a service called Dynamic Host Configuration Protocol that allows devices on the network to automatically obtain information such as IP, Default Gateway and DNS. Normally, we now use DHCP with IPv4, but IPv6 introduces two different DHCP services, Stateful and Stateless.

In Stateful DHCP, just like the DHCP server in IPv4, all the necessary information is provided by the DHCP server, and user information (IP and lease, etc.) is stored on the server. In Stateless DHCP, only DNS, etc. information is received from the DHCP server, IP and GW information are automatically generated by the user computer and user information (IP and lease, etc.) is not stored on the server. A computer on an IPv6 network automatically adjusts IP and GW information by utilizing NDP (Neighbor Discovery Protocol) packets from the router on the respective network.

BGP Finite State Machine: Troubleshooting

(See page 108 of the Halabi book for a diagram).

1. Idle

Waiting for Start event, normally initiated by the operator (establishing new BGP session or resetting an existing session). After errors, BGP falls back to the Idle state.

After a Start event, BGP initializes, resets connect retry timer, initiates TCP transport connection, and listens for connections initiated by a remote peer.

2. Connect

BGP is waiting for a transition protocol connection to complete. If TCP transport succeeds, transition to State 4, OpenSent, and send OPEN. If not, transition to Active. If the connect retry timer expires, remain in Connect, reset the timer, and initiate a transport connection. In case of any other event, transition back to Idle.

Introduction

When a site is implementing new router connectivity, it is useful to work from a configuration template to enhance productivity. This is particularly important in large-scale Frame Relay networks because auditing and altering router configurations to obtain consistency between hundreds of routers can be very tedious and time-consuming.

It is also useful for established sites to occasionally audit their router configurations to verify they are configured consistently, and that they are making best use of management and security features on the routers.

IPsec Security Association Choices

The previous article did not have space to cover some basic choices you have to make when deciding how to run IPsec.

One of the choices is whether you wish to use the Authentication Header (AH) or Encapsulating Security Payload (ESP). Each of these is an IP protocol, just as TCP and UDP are. The protocol codes are 51 and 50, for AH and ESP respectively. Thus IPsec packets will normally have 50 or 51 in the IP protocol field, and there will be an AH or ESP header between the IP header and the payload data.